Field of the Invention
This invention relates generally to the field of data processing systems. More particularly, the invention relates to advanced user authentication techniques and associated applications.
Description of Related Art
FIG. 1 illustrates an exemplary client 120 with a biometric device 100. When operated normally, a biometric sensor 102 reads raw biometric data from the user (e.g., capture the user's fingerprint, record the user's voice, snap a photo of the user, etc) and a feature extraction module 103 extracts specified characteristics of the raw biometric data (e.g., focusing on certain regions of the fingerprint, certain facial features, etc). A matcher module 104 compares the extracted features 133 with biometric reference data 110 stored in a secure storage on the client 120 and generates a score 153 based on the similarity between the extracted features and the biometric reference data 110. The biometric reference data 110 is typically the result of an enrollment process in which the user enrolls a fingerprint, voice sample, image or other biometric data with the device 100. An application 105 may then use the score 135 to determine whether the authentication was successful (e.g., if the score is above a certain specified threshold).
Systems have also been designed for providing secure user authentication over a network using biometric sensors. In such systems, the score 135 generated by the application 105, and/or other authentication data, may be sent over a network to authenticate the user with a remote server. For example, Patent Application No. 2011/0082801 (“'801 Application”) describes a framework for user registration and authentication on a network which provides strong authentication (e.g., protection against identity theft and phishing), secure transactions (e.g., protection against “malware in the browser” and “man in the middle” attacks for transactions), and enrollment/management of client authentication tokens (e.g., fingerprint readers, facial recognition devices, smartcards, trusted platform modules, etc).
The assignee of the present application has developed a variety of improvements to the authentication framework described in the '801 application. Some of these improvements are described in the following set of U.S. patent application (“Co-pending Applications”), all filed Dec. 29, 1012, which are assigned to the present assignee: Ser. No. 13/730,761, Query System and Method to Determine Authentication Capabilities; Ser. No. 13/730,776, System and Method for Efficiently Enrolling, Registering, and Authenticating With Multiple Authentication Devices; Ser. No. 13/730,780, System and Method for Processing Random Challenges Within an Authentication Framework; Ser. No. 13/730,791, System and Method for Implementing Privacy Classes Within an Authentication Framework; Ser. No. 13/730,795, System and Method for Implementing Transaction Signaling Within an Authentication Framework.
Briefly, the Co-Pending Applications describe authentication techniques in which a user enrolls with biometric devices of a client to generate biometric template data (e.g., by swiping a finger, snapping a picture, recording a voice, etc); registers the biometric devices with one or more servers over a network (e.g., Websites or other relying parties equipped with secure transaction services as described in the Co-Pending Applications); and subsequently authenticates with those servers using data exchanged during the registration process (e.g., encryption keys provisioned into the biometric devices). Once authenticated, the user is permitted to perform one or more online transactions with a Website or other relying party. In the framework described in the Co-Pending Applications, sensitive information such as fingerprint data and other data which can be used to uniquely identify the user, may be retained locally on the user's client device (e.g., smartphone, notebook computer, etc) to protect a user's privacy.
Authenticators such as those described above require some form of user interaction such as swiping the finger, or entering a secret code. These “normal” authenticators are intended to authenticate the user at a given point in time. In addition, “silent” authenticators may also be used which are designed to authenticate the user's device at a given point in time (rather than the user). These silent authenticators may rely on information extracted from the user's device without interaction by the user (e.g., sending a Machine-ID).
However, there are certain use cases where requiring explicit user interaction presents too much friction (e.g., near field communication (NFC) payments, frequently used apps requiring authentication without being tied to high value transactions), whereas a “silent” authentication technique such as sending a Machine-ID does not provide enough certainty that the legitimate user is still in possession of the device.
Several “continuous” authentication methods have been proposed by the research community such as Anthony J. Nicholson, “Mobile Device Security Using Transient Authentication,” IEEE TRANSACTIONS ON MOBILE COMPUTING VOL. 5, NO. 11, pp. 1489-1502 (November 2006); Mohammad O. Derawi, “Unobtrusive User-Authentication on Mobile Phones using Biometric Gait Recognition” (2010); and Koichiro Niinuma, Anil K. Jain, “Continuous User Authentication Using Temporal Information” (currently at http://www.cse.msu.edu/biometrics/Publications/Face/NiinumaJain_ContinuousAuth_SPIE10.pdf). Some of these methods have even been adopted by the industry such as BehavioSec, “Measuring FAR/FRR/EER in Continuous Authentication,” Stockholm, Sweden (2009). These methods generally provide an assurance level that the legitimate user is still in possession a device without adding friction to the authentication process, but they focus on a single modality (i.e. using a wearable token, gait recognition, face and color of clothing recognition and user's keyboard input).
One problem which exists, however, is that directly providing location data or other personal (e.g. face image, color of clothing, gait or typing characteristics, . . . ) or environmental data (e.g. temperature, humidity, WLAN SSIDs, . . . ) to the relying party for supplementing the risk estimation violates the user's privacy in some regions of the world. Consequently, more advanced remote authentication techniques are needed which are both non-intrusive and adequately protect the end user's privacy.
In addition, the strength of current authentication methods (e.g. passwords, fingerprint authentication, etc) is mostly constant over time, but the resulting risk varies based on the current environment in which authentication is performed (e.g. the machine being used, the network the machine is connected to, etc). It would be beneficial to select and/or combine authentication modalities based on the current detected risk.
When considering increasing the assurance level of authentication, typical methods for enhancing the level of explicit authentication methods like requiring more complex passwords or use more accurate biometric methods like fingerprint or face recognition come to mind. In reality, the authentication assurance level (or the transaction risk derived from it) also depends on other data, such as whether the authentication performed from the same device as before and whether the location of the authentication is realistically near to the location of the last successful authentication (e.g., authentication at 1 pm in San Francisco and at 2 pm same day in Tokyo doesn't seem to be realistic for one person).
Passwords still are the predominant explicit authentication methods. Unfortunately they are attacked easily and those attacks scale well. Additionally, entering passwords is cumbersome especially on small devices like smartphones. As a consequence many users do not use password based protection methods to lock their phones at all or they use trivial PIN code.
Some smartphones are using fingerprint sensors in order to provide a more convenient way to authentication. Using biometric modalities for authentication has been criticized for not providing sufficient spoofing attack resistance and for introducing privacy issues by potentially not protecting biometric reference data properly.
Various “fusion” methods for combining biometric modalities have been proposed. Some of them address usability issues by reducing the false rejection rate (FRR); other address the security issue by reducing the false acceptance rate (FAR). These methods thus far have proposed static fusion algorithms. Unfortunately this approach still leads to varying assurance levels depending on the “other inputs” (as discussed above).
For certain classes of transactions, the riskiness associated with the transaction may be inextricably tied to the location where the transaction is being performed. For example, it may be inadvisable to allow a transaction that appears to originate in a restricted country, such as those listed on the US Office of Foreign Asset Control List (e.g., Cuba, Libya, North Korea, etc). In other cases, it may only be desirable to allow a transaction to proceed if a stronger authentication mechanism is used; for example, a transaction undertaken from within the corporation's physical premises may require less authentication than one conducted from a Starbucks located in a remote location where the company does not have operations.
However, reliable location data may not be readily available for a variety of reasons. For example, the end user's device may not have GPS capabilities; the user may be in a location where Wifi triangulation data is unavailable or unreliable; the network provider may not support provide cell tower triangulation capabilities to augment GPS, or Wifi triangulation capabilities. Other approaches to divine the device's location may not have a sufficient level of assurance to meet the organization's needs; for example, reverse IP lookups to determine a geographic location may be insufficiently granular, or may be masked by proxies designed to mask the true network origin of the user's device.
In these cases, an organization seeking to evaluate the riskiness of a transaction may require additional data to provide them with additional assurance that an individual is located in a specific geographic area to drive authentication decisions.
Another challenge for organizations deploying authentication is to match the “strength” of the authentication mechanism to the inherent risks presented by a particular user's environment (location, device, software, operating system), the request being made by the user or device (a request for access to restricted information, or to undertake a particular operation), and the governance policies of the organization.
To date, organizations have had to rely on a fairly static response to the authentication needs of its users: the organization evaluates the risks a user will face during operations they normally perform and the requirements of any applicable regulatory mandate, and then deploys an authentication solution to defend against that risk and achieve compliance. This usually requires the organization to deploy multiple authentication solutions to address the multitude and variety of risks that their different users may face, which can be especially costly and cumbersome to manage.
The techniques described in the Co-pending Applications provide an abstraction that allows the organization to identify existing capabilities on the user's device that can be used for authentication. This abstraction shields an organization from the need to deploy a variety of different authentication solutions. However, the organization still needs a way to invoke the “correct” authentication mechanism when necessary. Existing implementations provide no capabilities for the organization to describe what authentication mechanism is appropriate under which circumstances. As a result, an organization would likely need to codify their authentication policy in code, making the solution brittle and necessitating code changes in the future to enable use of new authentication devices/tokens.
Electronic financial transactions today are conducted primarily through the World Wide Web using browser applications. Sites like Amazon.com, Dell, and Wal-Mart sell billions of dollars of merchandise via their online portals and banks and brokerages allow their customers to move billions of dollars of funds from account to account online. One challenge for web sites such as these is how to detect fraudulent activity. Fraudulent transactions can cost these companies billions of dollars.
The first line of defense against fraudulent transactions is the user's password. However, criminals can obtain passwords through a variety of techniques. Sometimes the password is weak in complexity and can easily be guessed or determined by a brute force attack. Other times, malware, worms, or viruses can infect a users computer. Passwords are then obtained by recording keystrokes or scanning memory or hard disk storage. If the actual device is stolen, passwords can be recovered from data that remains in memory or in storage. Once the password is compromised, criminals have the ability to access accounts and withdraw or move funds.
To try to prevent damage caused by the breach of a user's password, sites that deal with financial transactions employ risk assessment in which various metrics are used to determine if the person initiating the transaction is actually the user that owns the account. Factors such as the time of the transaction, the location of the transaction, and the circumstances of the transactions are all good ways to assess whether a transaction has risk. For example, it would be more unlikely for a transaction to be initiated at 3:00 AM versus 3:00 PM if the user does not typically have any activity on their account at night. Likewise, if the user lives in the United States but the transaction is initiated in Korea, that location difference would be a warning sign. Finally, if the amount of money being processed is significantly different in magnitude than normal, this is another signal of potential fraud.
Unfortunately, Web browsers place very strict limits on what information websites can obtain about the client system. Because browsers expose a user's machine to the outside (and possibly malicious) world, leaking any more data than necessarily is a security risk of its own. Certainly, it is possible to record the time of transactions, the location of the transaction (via the user's IP address for example), and the magnitude of the transaction. Web sites currently use all of this data to determine whether a transaction is fraudulent. However, beyond these basic pieces of information provided by the browser, web sites have no other information to utilize for risk assessment. Because of the limitations on what information the browsers can obtain, risk assessments for a user's transaction are not very precise.